Executive brief
OpenLink Virtuoso is a high-performance database and middleware platform used for managing large-scale data. A vulnerability in its SQL processing component allows an attacker to crash the database server by sending a specifically formatted SQL query. This results in a denial-of-service, making the database and any dependent applications unavailable to users until the service is restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in OpenLink Virtuoso OpenSource v7.2.11 within the `sqlo_tb_col_preds` component. The issue is triggered during the compilation or optimization phase of specific SQL queries, particularly those involving complex JOIN operations and the `contains()` function. An attacker with the ability to execute SQL queries against the database can trigger a null pointer dereference or similar memory corruption leading to a process crash (SIGSEGV). The vulnerability was identified via fuzzing and can be reproduced by executing a crafted SELECT statement involving a LEFT JOIN and a full-text search predicate. At the time of reporting, this affects version 7.2.11.
Affected products
- OpenLink Software Virtuoso OpenSource 7.2.11
Timeline
- 2024-01-07: disclosed: Issue reported on GitHub with PoC
- 2026-06-23: advisory: CVE published to NVD